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Once upon a time... More than a vulnerability scan program 
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Computing a score for each scope creates positive competition 
between each region 


Some IT admins and managers have a part of their annual bonus 
calculated based on the score 


Some Business Units are not fairly assessed as scanning of all their 
IP addresses is not mandatory 


Creation of a fairplay score to have BU register more assets, 
but difficult to keep up-to-date 


Local teams don’t always have the time to work on the service 
(ex : business value) 


Choose a popular and well-known programming language! 
(Python vs Ruby) 


Adapting our scripts took time 


Exploring and playing with the scanning profiles and report 
templates helps to find the ones we need 


We can’t rely on these reports only as we need to communicate 
the VuDiP score 


Establish a trustworthy relationship with our OT contacts 
Communication (contents & format) to Directors and Managers 
is not to be neglected 


Invest time to properly delegate scanning rights 
(allowed scope, training) 


